Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that’s being used to distribute malware such as Legion Loader.
According to Forescout Research – Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own machines.
“ROMULUS may be a privately operated panel, a commercial cybercriminal delivery service, an affiliate framework, or software that has been copied between operators,” security researcher Sai Molige said in an analysis.
The cybersecurity company said it identified six IP addresses running ROMULUS –
- 96.62.224[.]81
- 86.109.75[.]7
- 151.240.151[.]223
- 23.94.145[.]224
- 93.152.224[.]118
- 2.27.248[.]127
Notably, the IP address “96.62.224[.]81” was identified as hosting a ClickFix script and an MSI installer file in connection with another campaign that has been found to leverage malicious ChatGPT Custom GPTs to direct victims to a fake URL responsible for serving the ClickFix lure.
Forescout’s own analysis has since uncovered the same malware being delivered via another server, 86.109.75[.]7, that also hosted a panel codenamed ROMULUS. In addition, a separate chain triggered via ClickFix has been used to run a PowerShell script, which then delivers Legion Loader, a malware loader also called Satacom downloader, CurlyGate, and RobotDropper.
As of writing, it’s not known who is behind the ROMULUS platform. However, it shares no overlaps with RomulusLoader, a malware family associated with Silver Fox (aka TA4922), a China-aligned threat actor known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Venom RAT via DLL sideloading techniques.
The ROMULUS platform exposes two endpoints that are designed to download a PowerShell staging script, which decides the payload to be fetched next: a trojanized MSI installer carrying a malware loader or an encrypted archive containing Legion Loader. The loader, for its part, communicates with a remote server to fetch and run additional payloads.
The findings indicate how ClickFix is evolving beyond a social engineering technique into a highly effective entry point for malware. To mitigate the threat, it’s essential to hunt for suspicious PowerShell commands and DLL sideloading events.
